fix(tee): reject invalid session in invoke to close NULL-deref DoS (#247)

[bmolodan]

Description

Fixes a HIGH-severity, unauthenticated denial of service of the secure world,
reachable from the non-secure world through the live cmse_nonsecure_entry
ioctl() veneer.

tee_ioctl_invoke() (tee/kernel/entry_std.c) does not check the result of
tee_ta_get_session(). A non-secure caller can send TEE_IOC_INVOKE with an
invalid / zero / stale session id → find_session() returns NULL →
tee_ta_invoke_command() (tee/kernel/tee_ta_manager.c) dereferences it
(sess->ctx->ops->enter_invoke_cmd(...); the original OP-TEE guards are
commented out) → NULL dereference in the secure world → crash / DoS.

Fix (defense in depth, 2 files)

• tee/kernel/entry_std.c — tee_ioctl_invoke(): reject a NULL session
  with TEEC_ERROR_BAD_PARAMETERS, placed after copy_in_params() and right
  before tee_ta_invoke_command() — so a malformed request still gets the more
  specific parameter-validation error, and only an otherwise-valid request with
  a bad session id gets BAD_PARAMETERS.
• tee/kernel/tee_ta_manager.c — tee_ta_invoke_command(): a
  defense-in-depth if (!sess) return TEE_ERROR_BAD_PARAMETERS; at the top, at
  the dereference site, so no caller can trigger the fault.

close_session is unaffected — tee_ta_close_session() already handles NULL
(TEE_ERROR_ITEM_NOT_FOUND). Scope: ARM only (mps2_an505_qemu,
numaker_pfm_m2351); the RISC-V targets have no NS→S call boundary.

Fixes #247

Type of change

• Bug fix (non-breaking change which fixes an issue) — security
• New feature (non-breaking change which adds functionality)
• Code cleanup/refactoring
• CI system update
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Built and run under QEMU (qemu-system-arm -machine mps2-an505 -cpu cortex-m33).
A dedicated negative case drives the ioctl veneer with a valid non-secure
optee_msg_arg (num_params = 0) but a bogus session id (0xDEADBEEF).

• Build clean — entry_std.c + tee_ta_manager.c compile with no new
  warnings on all three build targets (mps2_an505_qemu,
  numaker_pfm_m2351, m2351_badge).
• With the fix — the bogus-session invoke returns 0xffff0006
  (TEEC_ERROR_BAD_PARAMETERS), no SecureFault; the secure world keeps
  servicing requests.
• Counter-check (non-vacuous) — on a build without the guards, the
  same call faults/hangs the secure world (the DoS itself), confirming the
  test exercises the guard.
• Regression — a normal open→invoke→close with a valid session is
  unaffected (the guard does not fire); the AES memref example still passes.

Test Configuration:

• Firmware version: mTower master + this fix
• Hardware: MPS2 AN505 (QEMU qemu-system-arm); NuMaker-PFM-M2351 (build-only)
• Toolchain: arm-none-eabi 8-2018-q4-major (as CI)
• SDK: N/A

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation — N/A (no doc change)
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
  (QEMU negative case + counter-check, run against a local test harness kept
  out of this patch)
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules — N/A

_{The runtime negative-test harness is developer tooling and is intentionally
not part of this patch, which is the minimal two-file fix.}